How to Prevent Ransomware: A 10-Step Defense Plan and 8 Endpoint Protection Tools to Compare

Ransomware is malware that encrypts files, often after stealing them, and demands payment for the decryption key or for silence. The CISA StopRansomware hub collects current advisories and response guidance, and the NIST Cybersecurity Framework gives a vocabulary (identify, protect, detect, respond, recover) that maps neatly onto the steps below.

This guide is for IT managers and security leads at small and mid-size companies who need a practical order of operations, not a theory lecture. It ends with how eight endpoint products listed in the Endpoint Protection Software category fit into a layered defense, including ESET PROTECT Advanced, which we use as the example for the whole-stack view on the vendor site: ESET.

How Does Ransomware Get In?

Most ransomware arrives through a small set of doors: phishing emails with malicious links or attachments, exposed remote access such as RDP or VPN gateways, unpatched internet-facing software, and stolen credentials bought from other criminals. Closing these four doors removes most of the practical risk.

Attackers rarely start with encryption. They first gain access, escalate to administrator rights, disable security tools and copy data, then encrypt on a weekend or holiday when response is slow. That timeline is your opportunity: controls that detect the early stages, such as unusual remote logins or credential dumping, can stop an incident before any file is locked.

Common initial access routes

• Phishing with weaponized documents, disk images or links to fake login pages
• Internet-exposed remote desktop or VPN appliances without MFA
• Exploited vulnerabilities in edge devices, file transfer tools and web servers
• Reused or leaked passwords from previous breaches

Patch and Reduce Your Attack Surface

Patch internet-facing systems first and fastest, then everything else on a defined schedule. Remove or firewall services nobody needs, because every open port is a possible entry point. Track exploited vulnerabilities rather than severity scores alone, since attackers favor flaws that already have working exploit code.

Build an asset inventory so you know what is exposed. Scan externally at least monthly and after every change to firewall rules. Many teams pair endpoint tools with vulnerability management software and a policy-driven firewall that blocks inbound access by default. The NIST guidance in SP 800-41 Rev. 1 describes sensible firewall policy design.

• Set a patch service level: for example, critical internet-facing flaws within days, not weeks
• Retire end-of-life operating systems or isolate them on restricted segments
• Disable legacy protocols such as SMBv1 and unneeded macros
• Review exposed services after every infrastructure change

Lock Down Identities and Remote Access

Require multi-factor authentication for every remote access path, administrator account and email login. Never expose RDP directly to the internet; place it behind a VPN or zero-trust gateway. Stolen passwords are the most common way past a perimeter, so a second factor removes a whole class of attacks.

Use separate administrator accounts that never browse the web or read email, and apply least privilege so a single infected laptop cannot reach file servers or backup consoles. Review service accounts, because they often hold broad rights and never change passwords. If your staff use remote support tools, standardize on one approved product and log every session; see our guide to setting up secure remote access.

Stop Ransomware at the Email Gateway and Endpoint

Filter email for malicious links, attachments and spoofed senders, block macros from the internet by default, and run endpoint protection that uses behavior monitoring, application control or machine learning to stop unknown programs. Signature-only antivirus alone misses new ransomware strains.

Endpoint protection is the last line before encryption. Look for ransomware-specific behavior detection (mass file renaming or encryption), tamper protection so malware cannot switch the agent off, central management and alerting, and the ability to isolate a device quickly. Larger environments should compare these suites with EDR; our endpoint protection software guide explains the difference.

Application allow-listing

Allow-listing flips the default: only approved software may run. It is the strongest control against unknown ransomware but needs an owner to approve new software. Start in monitor mode on a pilot group, then enforce on servers, where change is rare.

Limit Spread with Least Privilege and Segmentation

Segmentation keeps one infected device from reaching everything else. Separate user networks, servers, backup systems and management interfaces, restrict file shares to the groups that need them, and remove local administrator rights from daily accounts. Containment turns a company-wide outage into a single-department incident.

Pay special attention to domain controllers and hypervisors, because encrypting them multiplies the damage. Block outbound traffic from servers that have no reason to browse the internet, and alert on large internal file transfers, which often signal data theft before encryption begins.

Build Backups That Survive an Attack

Keep at least three copies of critical data on two media types with one copy offline or immutable, and test restores regularly. Backups attached to the same domain as production are routinely deleted by attackers, so isolate credentials and enable immutability or air gaps.

Recovery time matters as much as recovery itself. Measure how long it takes to restore your most critical systems, and write down the order in which they return. A simple planning formula helps set targets:

Data to restore is the total size of the systems you need first, restore throughput is the sustained rate your backup platform and network achieve in a real test, and validation and rebuild time covers malware cleaning, identity resets and application checks. Use the result to decide whether your current backup design meets business expectations.

Compare Endpoint Products Used in a Ransomware Defense

The eight endpoint products below span lightweight cloud-managed agents for small teams to enterprise suites. All listings come from the SaaSPodium directory; verify features and pricing with each vendor, because ransomware capabilities vary by edition and licence tier.

Prices are the listed starting figures in SaaSPodium as of November 2026 and are not quotes; units and minimum seat counts differ by vendor.

How to read the table

Small teams usually want one cloud console with automatic updates and minimal tuning, which fits the lighter suites. Medium and enterprise buyers should ask about application control, device isolation, EDR upgrade paths, SIEM integration and role-based access. Run a pilot on a mixed set of laptops and servers and simulate common attacker behavior with your security team before signing a multi-year deal.

Prepare an Incident Response Plan

Write a short ransomware playbook before you need it: who declares an incident, how to isolate devices, where offline contact lists live, who talks to legal, insurers and regulators, and how restoration is prioritized. Rehearse it twice a year with a tabletop exercise.

The first hour usually decides the outcome. Disconnect affected machines from the network without powering them off when possible, preserve logs, reset privileged credentials from a clean device and notify your cyber insurer and legal counsel early. Decisions about payment involve legal and sanctions considerations, so take advice instead of improvising. Reporting channels and current guidance are on the CISA site linked above.

A 30-Day Ransomware Readiness Checklist

Start with the controls that remove the most risk per hour of effort: MFA everywhere, closing exposed remote access, patching edge devices, verifying backups and deploying consistent endpoint protection. Then move to segmentation, allow-listing and rehearsals.

• Week 1: inventory internet-facing assets, enforce MFA, close direct RDP
• Week 2: patch critical edge systems, deploy or tune endpoint protection, enable tamper protection
• Week 3: separate admin accounts, isolate backups, run a full restore test
• Week 4: segment key networks, run a tabletop exercise, document the playbook

Frequently Asked Questions

How much does ransomware protection cost for a small business?
SaaSPodium lists starting prices from 25 to 55 for the eight endpoint products above as of November 2026, but units, seat minimums and edition differences vary. Add backup, email filtering and MFA, and request quotes for your exact device count.

Is antivirus enough to stop ransomware?
No. Traditional signature antivirus misses new variants. Combine behavior-based endpoint protection with patching, MFA, email filtering, least privilege and isolated, tested backups so that a single failure does not become a company-wide outage.

How long does it take to deploy endpoint protection?
Cloud-managed agents can be piloted on a handful of devices in a day and rolled out to a small company within one to two weeks. Larger estates need time for policy tuning, exclusions, server testing and change approvals.